another newbie question

Carter Bullard carter at
Tue Jan 20 12:39:12 EST 2004

Hey Guys,
   Kevin is right, argus-clients do not use tcpdump's filter.
Don't use '!', unless you escape it, as most shells use it
as a history char.

So, your network filters are not quite right, and they are
not equivalent.

	net mask
	net mask
	net mask

The way it works is that the filter takes the address to
be tested, applies the mask, and then compares the result to
the network address provided.  So, the first and third filters
will never match, as the third octet will be obliterated
by the mask, and the result will not equal the provided
network address.

Try a CIDR address or if it's a classic C/B/A address, you
can put just the network number.

   ramon [options] - dst net and not net 192.168.10


-----Original Message-----
From: owner-argus-info at
[mailto:owner-argus-info at] On Behalf Of Kevin C Miller
Sent: Tuesday, January 20, 2004 12:06 PM
To: Furnish, Trever G; Argus List (E-mail)
Subject: Re: another newbie question

It's just the BPF language that tcpdump and others use.

I would use 'not' instead of '!', e.g. "dst net mask and not net mask"

Also, isn't a valid netmask. Do you mean ?


--On Tuesday, January 20, 2004 11:58 AM -0500 "Furnish, Trever G"
<TGFurnish at> wrote:

> [root at enterprise u01]# ramon -M Matrix -n -L0 -r /u01/argus.log - dst net
> mask and ! net mask |
> wc -l
>     341

Kevin C. Miller <kcm at>
Network Development
Carnegie Mellon University

More information about the argus mailing list